← Back to feed
HASSH 80d9e1d7a4fa… — SSH-2.0-Go (54 IPs, 18 countries)
HASSH Ended highWhy this campaign was detected
54 IPs are running an identical SSH client (HASSH fingerprint 80d9e1d7a4fa…). Top network: netcup GmbH (AS197540). Geographic and ASN spread across distinct /16 subnets indicates a single operator running shared tooling on rented infrastructure — exactly the disguise that subnet/ASN clustering misses.
Primary ASN
AS197540 · netcup GmbH
Subnet
—
HASSH Fingerprint
Country
🇩🇪 DE
Cloud Provider
DO
Member Count
54 IPs
Average
Total Events
1968
Below average by volume
Started / Ended
2026-05-23 11:44 — ongoing
Attack Types
MITRE ATT&CK Techniques
Initial Access
Member Actors
| IP Address | Behavior | Confidence | Flags | Events | Agents | Attack Types | Hostname | Last Seen | |
|---|---|---|---|---|---|---|---|---|---|
| 159.223.29.238 | credential_harvester | 33% | 1x OSINT | 81 | 1 | ssh:bruteforce | — | 2026-08-24 06:31 | evidence → |
| 40.81.23.49 | credential_harvester | 32% | 1x OSINT | 56 | 1 | ssh:bruteforce | — | 2026-08-24 07:34 | evidence → |
| 152.53.199.246 | reconnaissance | 32% | 1x OSINT | 50 | 1 | ssh:bruteforce | — | 2026-08-08 18:20 | evidence → |
| 43.128.214.214 | reconnaissance | 31% | 1x OSINT | 30 | 1 | ssh:bruteforce | — | 2026-08-08 04:21 | evidence → |
| 43.172.92.108 | scanner | 30% | 1x OSINT | 17 | 1 | ssh:bruteforce | — | 2026-08-08 08:02 | evidence → |
| 114.70.63.104 | scanner | 30% | 1x OSINT | 17 | 1 | ssh:bruteforce | — | 2026-08-08 07:37 | evidence → |
| 31.70.94.155 | scanner | 30% | 1x OSINT | 12 | 1 | ssh:bruteforce | — | 2026-08-08 05:12 | evidence → |
| 135.106.176.69 | scanner | 29% | 135 | 1 | ssh:bruteforce | — | 2026-08-11 12:33 | evidence → | |
| 89.163.206.150 | reconnaissance | 29% | 130 | 1 | ssh:bruteforce | — | 2026-08-10 13:43 | evidence → | |
| 103.159.85.123 | credential_harvester | 29% | 102 | 1 | ssh:bruteforce | — | 2026-08-13 08:27 | evidence → | |
| 150.241.245.127 | scanner | 28% | 72 | 1 | ssh:bruteforce | — | 2026-08-12 07:51 | evidence → | |
| 200.119.252.26 | scanner | 28% | 69 | 1 | ssh:bruteforce | — | 2026-08-11 20:22 | evidence → | |
| 185.232.68.89 | scanner | 28% | 62 | 1 | ssh:bruteforce | — | 2026-08-08 18:33 | evidence → | |
| 202.61.252.80 | reconnaissance | 28% | 58 | 1 | ssh:bruteforce | — | 2026-08-08 18:42 | evidence → | |
| 160.251.173.161 | reconnaissance | 28% | 56 | 1 | ssh:bruteforce | — | 2026-08-11 12:51 | evidence → | |
| 194.180.176.29 | scanner | 28% | 56 | 1 | ssh:bruteforce | — | 2026-08-11 14:40 | evidence → | |
| 15.204.173.173 | reconnaissance | 28% | 56 | 1 | ssh:bruteforce | — | 2026-08-11 12:24 | evidence → | |
| 38.83.138.198 | reconnaissance | 27% | 51 | 1 | ssh:bruteforce | — | 2026-08-08 18:39 | evidence → | |
| 139.84.167.125 | reconnaissance | 27% | 50 | 1 | ssh:bruteforce | — | 2026-08-08 06:40 | evidence → | |
| 94.16.17.138 | scanner | 27% | 49 | 1 | ssh:bruteforce | — | 2026-08-08 18:02 | evidence → | |
| 89.58.12.105 | scanner | 27% | 47 | 1 | ssh:bruteforce | — | 2026-08-08 18:19 | evidence → | |
| 213.32.22.42 | reconnaissance | 27% | 43 | 1 | ssh:bruteforce | — | 2026-08-08 18:24 | evidence → | |
| 129.226.201.189 | reconnaissance | 27% | 40 | 1 | ssh:bruteforce | — | 2026-08-08 18:13 | evidence → | |
| 152.53.254.198 | scanner | 27% | 37 | 1 | ssh:bruteforce | — | 2026-08-08 06:20 | evidence → | |
| 178.105.235.156 | reconnaissance | 27% | 35 | 1 | ssh:bruteforce | — | 2026-08-08 18:33 | evidence → | |
| 43.153.138.134 | scanner | 27% | 34 | 1 | ssh:bruteforce | — | 2026-08-08 07:17 | evidence → | |
| 89.125.17.138 | scanner | 27% | 31 | 1 | ssh:bruteforce | — | 2026-08-08 05:48 | evidence → | |
| 43.129.69.48 | scanner | 27% | 31 | 1 | ssh:bruteforce | — | 2026-08-08 07:49 | evidence → | |
| 5.45.101.104 | scanner | 27% | 31 | 1 | ssh:bruteforce | — | 2026-08-08 07:45 | evidence → | |
| 46.34.163.208 | reconnaissance | 26% | 30 | 1 | ssh:bruteforce | — | 2026-08-08 05:47 | evidence → | |
| 159.195.38.88 | reconnaissance | 26% | 28 | 1 | ssh:bruteforce | — | 2026-08-08 18:31 | evidence → | |
| 91.98.146.93 | scanner | 26% | 27 | 1 | ssh:bruteforce | — | 2026-08-08 06:21 | evidence → | |
| 37.32.13.146 | scanner | 26% | 27 | 1 | ssh:bruteforce | — | 2026-08-08 07:59 | evidence → | |
| 24.233.0.36 | reconnaissance | 26% | DROP | 25 | 1 | ssh:bruteforce | — | 2026-08-08 18:04 | evidence → |
| 43.134.175.151 | scanner | 26% | 24 | 1 | ssh:bruteforce | — | 2026-08-08 04:18 | evidence → | |
| 185.4.74.43 | scanner | 26% | 24 | 1 | ssh:bruteforce | — | 2026-08-08 06:01 | evidence → | |
| 38.95.74.33 | scanner | 26% | 24 | 1 | ssh:bruteforce | — | 2026-08-08 04:30 | evidence → | |
| 43.173.69.32 | scanner | 26% | 24 | 1 | ssh:bruteforce | — | 2026-08-08 08:17 | evidence → | |
| 142.93.58.163 | reconnaissance | 26% | 20 | 1 | ssh:bruteforce | — | 2026-08-08 07:37 | evidence → | |
| 37.221.196.248 | scanner | 26% | 17 | 1 | ssh:bruteforce | — | 2026-08-08 07:22 | evidence → | |
| 216.126.224.30 | scanner | 26% | 17 | 1 | ssh:bruteforce | — | 2026-08-08 07:43 | evidence → | |
| 223.19.9.7 | reconnaissance | 25% | 10 | 1 | ssh:bruteforce | — | 2026-08-08 07:39 | evidence → | |
| 23.254.242.32 | credential_probe | 18% | 1x OSINT | 22 | 1 | ssh:bruteforce | — | 2026-08-08 17:48 | evidence → |
| 43.134.68.207 | credential_probe | 18% | 1x OSINT | 21 | 1 | ssh:bruteforce | — | 2026-08-08 04:47 | evidence → |
| 77.90.42.3 | credential_probe | 15% | 52 | 1 | ssh:bruteforce | — | 2026-08-08 18:47 | evidence → | |
| 78.47.87.101 | credential_probe | 14% | 37 | 1 | ssh:bruteforce | — | 2026-08-08 18:22 | evidence → | |
| 77.42.84.102 | credential_probe | 13% | 21 | 1 | ssh:bruteforce | — | 2026-08-08 04:34 | evidence → | |
| 198.46.221.48 | credential_probe | 13% | 14 | 1 | ssh:bruteforce | — | 2026-08-08 06:06 | evidence → | |
| 77.68.32.53 | credential_probe | 13% | 14 | 1 | ssh:bruteforce | — | 2026-08-09 06:59 | evidence → | |
| 87.106.236.211 | credential_probe | 12% | 7 | 1 | ssh:bruteforce | — | 2026-08-08 08:11 | evidence → | |
| 109.205.181.30 | credential_probe | 12% | 7 | 1 | ssh:bruteforce | — | 2026-08-08 07:29 | evidence → | |
| 85.215.242.189 | credential_probe | 12% | 7 | 1 | ssh:bruteforce | — | 2026-08-08 07:23 | evidence → | |
| 51.79.107.91 | credential_probe | 12% | 7 | 1 | ssh:bruteforce | — | 2026-08-08 08:41 | evidence → | |
| 212.109.195.22 | credential_probe | 12% | 7 | 1 | ssh:bruteforce | — | 2026-08-08 08:34 | evidence → |
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds